[oauth2] Client credentials should be optional

As discussed here:
https://github.com/tomchristie/django-rest-framework/issues/759

I have two concerns about this implementation:
- Since https://github.com/caffeinehit/django-oauth2-provider/pull/15 is not merged to django-oauth2-provider, I did use datetime.datetime to check for expire, which differs from the rest of restframework, that is timezone aware. It would be very nice to see that merged.
- This way, client credentials is optional, but if then are not needed at all, the code could be much simpler by not verifying for client credentials